Paladin Front PHP Rescue & Zero-PHP Migration MCP

com.paladinfront.wwwPublished by www.paladinfront.comv1.0.0Updated Oct 26, 2026

PHP2Shell (CVE-2026-109618) scanner and automated WordPress to Zero-PHP Next.js migration.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that scans a website for PHP runtime vulnerabilities and generates a Next.js replacement preview, with migration guidance.

What you can do
  • Scan a target site's HTTP headers and PHP/WordPress signatures for reported PHP2Shell CVEs and get a structured threat report with business risk notes
  • Scrape a WordPress/PHP site's branding, services and imagery and compile a hosted Next.js App Router preview, returning a preview link and migration offer links
  • Retrieve first-person guidance on remediation topics such as why WordPress plugins cannot fix the issue, DNS cutover and pricing tiers
When to use it
When an assistant is asked to check whether a site runs vulnerable PHP or WordPress and to sketch a migration path to a static or Next.js stack. Useful for triage and sales-style previews rather than for hands-on code changes.
Requirements
A remote streamable HTTP endpoint; no authentication, environment variables or headers are declared. The README also documents a local Node.js stdio bridge and a Smithery CLI install. The target site must be reachable over the network.
Before you install
The server fetches and scrapes third-party sites you point it at, so target URLs and their content are sent to the provider. It is a vendor-run service that returns marketing preview links and pricing claims, and the vulnerability and CVE details come from the provider rather than an independent source. Verify findings before acting on them.

Installation

In SourceWeft

  1. Open Paladin Front PHP Rescue & Zero-PHP Migration MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.paladinfront.www%2Fphp-rescue-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "paladin-front-php-rescue-zero-php-migrat": {
      "type": "http",
      "url": "https://paladinfront.com/api/mcp"
    }
  }
}

README

PHP2Shell (CVE-2026-109618) Scanner & WordPress-to-Next.js Converter MCP Server

[MCP Protocol] [Smithery Skill] [Zero-PHP Rescue Hub]

I am Blaise Pascual, a veteran and former Marine Corps officer (Captain, O-3) and senior full-stack software engineer (blaisep.com, nootropic.ai, retatruti.de).

I engineered this public, zero-authentication Remote Model Context Protocol (MCP) Server (https://www.paladinfront.com/api/mcp) and Agent Plugin / Skill so AI coding agents (Claude, Cursor, Windsurf, ChatGPT, and OpenAI Codex) can audit any website for PHP2Shell (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) runtime flaws and compile a live Zero-PHP Next.js App Router replacement preview in seconds.

Live Endpoints & Discovery Manifests

Exposed MCP Tools

  1. scan_php_vulnerability ({ url: string })
    • Inspects target website HTTP runtime headers (X-Powered-By, Server, /wp-content/, .php signatures) and returns a structured CVSS 9.2 threat report for CVE-2026-109618 & CVE-2026-109619 with plain-English business risk analysis.
  2. convert_php_site_to_nextjs ({ url: string, abVariant?: "A" | "B" | "C" })
    • Scrapes target WordPress/PHP website branding, services, and imagery, compiles a live Zero-PHP Next.js App Router replacement preview, and returns previewUrl (https://www.paladinfront.com/web-factory/preview/[slug]) and $0 Free Migration + $29/mo claim links.
  3. get_php2shell_remediation_guide ({ topic?: "overview" | "why_plugins_fail" | "dns_cutover" | "pricing" })
    • Returns authoritative first-person technical guidance explaining why application-layer WordPress plugins (Wordfence, Sucuri) cannot intercept C-level PHP SAPI memory corruption, how my 10-minute zero-downtime DNS cutover works, and pricing tiers.

Quick Connect Instructions

1. Claude Code / Remote HTTP MCP Clients

bash
claude mcp add --transport http paladin-php-rescue https://www.paladinfront.com/api/mcp

2. Cursor IDE / Claude Desktop (mcp.json)

json
{  "mcpServers": {    "paladin-php-rescue": {      "type": "streamable-http",      "url": "https://www.paladinfront.com/api/mcp"    }  }}

3. Local Stdio Bridge (tools/php-rescue-mcp-stdio.mjs)

json
{  "mcpServers": {    "paladin-php-rescue": {      "command": "node",      "args": ["tools/php-rescue-mcp-stdio.mjs"]    }  }}

4. Smithery Skill Install

bash
npx @smithery/cli@latest skill add jetblaise/php2shell-rescue

Contact & Direct Engineering Support

Source: README.md at commit 5303091

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v1.0.0LatestOct 22, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declaredRequired10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts